Restrictions for DMVPN Dynamic Tunnels Between Spokes. Behind a NAT Device. Finding Feature Information
|
|
- Cynthia Chase
- 5 years ago
- Views:
Transcription
1 DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device The DMVPN: Dynamic Tunnels Between Spokes Behind a NAT Device feature allows Next Hop Resolution Protocol (NHRP) spoke-to-spoke tunnels to be built in Dynamic Multipoint Virtual Private Networks (DMVPNs), even if one or more spokes is behind a Network Address Translation (NAT) device. Finding Feature Information, page 1 Restrictions for DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device, page 1 Information About DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device, page 2 Additional References, page 6 Feature Information for DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device, page 8 Finding Feature Information Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to An account on Cisco.com is not required. Restrictions for DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device In order for spokes to build tunnels between them, they need to know the post-nat address of the other spoke. Consider the following restrictions when using spoke-to-spoke tunneling in NAT environments: Multiple NAT translations --A packet can go across multiple NAT devices in a nonbroadcast multiaccess (NBMA) DMVPN cloud and make several (unimportant) translations before it reaches its destination. 1
2 Information About DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device The last translation is the important translation because it is used to create the NAT translation for all devices that reach a spoke through the last NAT device. Hub or spoke can be reached through pre-nat addresses --It is possible for two or more spokes to be behind the same NAT device, which can be reached through a pre-nat IP address. Only the post-nat IP address is relied on even if it means that a tunnel may take a less desirable path. If both spokes use NAT through the same device, then a packet may not travel inside-out or outside-in as expected by the NAT device and translations may not occur correctly. Interoperability between NAT and non-nat capable devices --In networks that are deployed with DMVPN, it is important that a device with NHRP NAT functionality operate together with non-nat supported devices. A capability bit in the NHRP packet header indicates to any receiver whether a sending device understands a NAT extension. Same NAT translation --A spoke s post-nat IP address must be the same when the spoke is communicating with its hubs and when it is communicating with other spokes. For example, a spoke must have the same post-nat IP address no matter where it is sending tunnel packets within the DMVPN network. If one spoke is behind one NAT device and another different spoke is behind another NAT device, and Peer Address Translation (PAT) is the type of NAT used on both NAT devices, then a session initiated between the two spokes cannot be established. One example of a PAT configuration on a NAT interface is: ip nat inside source list nat_acl interface FastEthernet0/1 overload Information About DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device The following sections describe how DMVPN: Dynamic Tunnels Between Spokes Behind a NAT Device allows spoke-to-spoke tunnels to be built even if one or both spoke devices are behind a NAT device: DMVPN Spoke-to-spoke Tunneling Limited to Spokes not Behind a NAT Device NAT allows a single device, such as a router, to act as agent between the Internet (or public network ) and a local (or private ) network, and is often used because of the scarcity of available IP addresses. A single unique IP address is required to represent an entire group of devices to anything outside the NAT devi ce. NAT is also deployed for security and administration purposes. In DMVPN networks, spoke-to-spoke tunneling is limited to spokes that are not behind the NAT device. If one or both spokes are behind a NAT device, a spoke-to-spoke tunnel cannot be built to or from the NAT device because it is possible for the spoke-to-spoke tunnel traffic to fail or be lost black-holed for an extended period of time. 2
3 DMVPN Spoke-to-spoke Tunneling Limited to Spokes not Behind a NAT Device The diagram below and the following sections describe how DMVPN works when spoke-to-spoke tunneling is limited to spokes that are not behind a NAT device. Figure 1: Implementation of DMVPN Spoke-to-spoke Tunneling Limited to Spokes Not Behind a NAT Device NHRP Registration When an NHRP registration is received, the hub checks the source IP address on the encapsulating GRE/IP header of the NHRP packet with the source NBMA IP address, which is contained in the NHRP registration packet. If these IP addresses are different, then NHRP knows that NAT is changing the outer IP header source address. The hub preserves both the pre- and post-nat address of the registered spoke. Note If encryption is used, then IPsec transport mode must be used to enable NHRP. The following show ip nhrp command output example shows the source IP address of the NHRP packet and tunnel information for Spoke B in the figure above: Note The NBMA (post-nat) address for Spoke B is (the claimed NBMA (pre-nat) source address is ). Router# show ip nhrp /32 via , Tunnel0 created 00:00:21, expire 00:05:38 Type: dynamic, Flags: authoritative unique registered used 3
4 NHRP Spoke-to-Spoke Tunnel with a NAT Device DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device NBMA address: (Claimed NBMA address: ) NHRP Resolution The following describes the NHRP resolution process between Spoke A and Spoke B shown in the figure above, where Spoke B is behind a NAT device with pre-nat address of and a post-nat address of : The NHRP table entry for Spoke B on the hub contains both the post-nat and pre-nat addresses. When the hub receives an NHRP resolution request for the VPN address (tunnel address) of Spoke B, it answers with its own NBMA address instead of Spoke B s NBMA address. When the hub receives an NHRP resolution request sourced from Spoke B for any other spoke, the hub also answers with its own NBMA address. This ensures that any attempt to build a spoke-to-spoke tunnel with Spoke B results in the data packets being sent through the hub rather than through a spoke-to-spoke tunnel. For example: Data traffic from source IP address (behind Spoke A) to destination IP address (behind Spoke B) triggers Spoke A to send a resolution request for Spoke B ( ) to the next hop router (hub). The hub receives the resolution request and finds a mapping entry for Spoke B ( ). Because Spoke B is behind a NAT device, it acts as a proxy and replies with its own NBMA address ( ). The hub also receives a resolution request from Spoke B for Spoke A ( ). Because Spoke B is behind a NAT device, it acts as a proxy and replies with its own NBMA address ( ). This restricts any spoke-to-spoke traffic to or from Spoke B to travel through the hub router, which is done rather than having a tunnel between the spokes. NHRP Spoke-to-Spoke Tunnel with a NAT Device The NHRP Spoke-to-Spoke Tunnel with NAT introduces NAT extension in the NHRP protocol and is enabled automatically. The NHRP NAT extension is a Client Information Entry (CIE) entry with information about the protocol and post-nat NBMA address. This additional information allows the support of spoke-to-spoke tunnels between spokes where one or both are behind a NAT device without the problem of losing (black-holing) traffic for an extended period of time. Note The spoke-to-spoke tunnel may fail to come up, but it is detected and the data traffic flows through the hub, rather than being lost (black-holed). 4
5 NHRP Spoke-to-Spoke Tunnel with a NAT Device the diagram below shows how the NHRP spoke-to-spoke tunnel works with NAT. Figure 2: NHRP Between Spoke-to-Spoke Tunnels NHRP Registration Process The following steps describe the NHRP registration process: 1 A spoke sends a registration request with the NAT-Capability=1 parameter and a NAT NHRP extension of the NBMA address of the hub as configured on the spoke. 2 The hub compares the NHRP (NAT) extension with its configured NBMA address and determines whether it itself is or is not behind a NAT device. The hub also makes a note of whether the spoke is behind a NAT device by comparing the incoming GRE/IP source address with the spoke s NBMA address in the NHRP packet. 3 The registration reply from the hub to the spoke includes a NAT NHRP extension with the post-nat address of the spoke, if the hub detects if it is behind a NAT device. 4 If the spokes get a NAT NHRP extension in the NHRP registration reply it then records its post-nat IP address for possible use later. NHRP Resolution and Purge Process The following steps describe the NHRP resolution and purge process: 5
6 Additional References DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device 1 When a spoke is behind a NAT device, it includes a NAT NHRP extension when it sends NHRP resolution requests. 2 The hub receives the resolution request. If the spoke is behind a NAT device and there is no NAT extension, then the hub adds a NAT extension before forwarding this extension to the next node (spoke or next hop server) along the path. However, if the hub is forwarding the request to a non-nat extension capable node, it rewrites the source-nbma inside the packet to be the post-nat IP address for the requesting spoke rather than its pre-nat IP address. 3 The receiver (spoke) uses a NAT NHRP extension record (NAT capable) or the source NBMA address (non-nat capable information) to build the tunnel. This spoke s reply includes its own NAT extension if it is behind a NAT device. Note Hubs do not answer NHRP resolution requests on behalf of spokes. Hubs always forward NHRP resolution requests to the end spoke that has the requested tunnel IP address or services the requested data from the host IP address. The following describes the NHRP resolution process between Spoke A and Spoke B shown in the figure above, where Spoke B is behind a NAT device with pre-nat address and post-nat address of : Data traffic to the /24 network from hosts behind Spoke A triggers an NHRP resolution request for Spoke B s tunnel IP address ( ) to be sent through the hub. The hub receives a resolution request and forwards it to Spoke B. Spoke B creates a dynamic spoke-to-spoke tunnel using the source NBMA IP address for Spoke A from the NHRP resolution request and sends an NHRP resolution reply directly to Spoke A. It includes its post-nat address in the NAT NHRP-extension header. Alternatively, traffic to the /24 network from hosts behind the NAT device on Spoke B triggers an NHRP resolution request for Spoke A s tunnel IP address ( ). Spoke B adds its own post-nat IP address in the NHRP NAT-extension in the resolution request. The hub receives a resolution request and forwards it to Spoke A. Spoke A parses the NHRP NAT-extension and builds a tunnel using Spoke B s post-nat address and replies directly to Spoke B. Additional References Related Documents Related Topic NHRP commands: complete command syntax, command mode, command history, defaults, usage guidelines, and examples Dynamic multipoint VPN Document Title Cisco IOS IP Addressing Services Command Reference Dynamic Multipoint VPN (DMVPN) 6
7 Additional References Standards Standard No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. Title -- MIBs MIB No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. MIBs Link To locate and download MIBs for selected platforms, Cisco IOS software releases, and feature sets, use Cisco MIB Locator found at the following URL: RFCs RFC No new or modified RFCs are supported by this release. Title -- Technical Assistance Description The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. Link 7
8 Feature Information for DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device Feature Information for DMVPN Dynamic Tunnels Between Spokes Behind a NAT Device The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to An account on Cisco.com is not required. Table 1: Feature Information for DMVPN: Dynamic Tunnels Between Spokes Behind a NAT Device Feature Name DMVPN: Dynamic Tunnels Between Spokes Behind a NAT Device Releases 12.4(15)T Feature Information The DMVPN: Dynamic Tunnels Between Spokes Behind a NAT Device feature allows NHRP spoke-to-spoke tunnels to be built in DMVPN networks, even if one or more spokes is behind a Network Address Translation (NAT) device. 8
Shortcut Switching Enhancements for NHRP in DMVPN Networks
Shortcut Switching Enhancements for NHRP in DMVPN Networks Routers in a Dynamic Multipoint VPN (DMVPN) Phase 3 network use Next Hop Resolution Protocol (NHRP) Shortcut Switching to discover shorter paths
More informationDMVPN Event Tracing. Finding Feature Information
The feature provides a trace facility for troubleshooting Cisco IOS Dynamic Multipoint VPN (DMVPN). This feature enables you to monitor DMVPN events, errors, and exceptions. During runtime, the event trace
More informationIP Overlapping Address Pools
The feature improves flexibility in assigning IP addresses dynamically. This feature allows you to configure overlapping IP address pool groups to create different address spaces and concurrently use the
More informationIPsec NAT Transparency
The feature introduces support for IP Security (IPsec) traffic to travel through Network Address Translation (NAT) or Port Address Translation (PAT) points in the network by addressing many known incompatibilities
More informationRADIUS Route Download
The feature allows users to configure their network access server (NAS) to direct RADIUS authorization. Finding Feature Information, page 1 Prerequisites for, page 1 Information About, page 1 How to Configure,
More informationConfiguring DHCP Option 60 and Option 82 with VPN-ID Support for Transparent Automatic Logon
Configuring DHCP Option 60 and Option 82 with VPN-ID Support for Transparent Automatic Logon Intelligent Services Gateway (ISG) is a Cisco software feature set that provides a structured framework in which
More informationEncrypted Vendor-Specific Attributes
The feature provides users with a way to centrally manage filters at a RADIUS server and supports the following types of string vendor-specific attributes (VSAs): Tagged String VSA, on page 2 (similar
More informationFPG Endpoint Agnostic Port Allocation
When the Endpoint Agnostic Port Allocation feature is configured, an entry is added to the Symmetric Port Database. If the entry is already available, the port listed in the Symmetric Port Database is
More information802.1P CoS Bit Set for PPP and PPPoE Control Frames
802.1P CoS Bit Set for PPP and PPPoE Control The 802.1P CoS Bit Set for PPP and PPPoE Control feature provides the ability to set user priority bits in the IEEE 802.1Q tagged frame to allow traffic prioritization.
More informationQuality of Service for VPNs
The QoS for VPNs feature provides a solution for making Cisco IOS QoS services operate in conjunction with tunneling and encryption on an interface. Cisco IOS software can classify packets and apply the
More informationConfiguring the Physical Subscriber Line for RADIUS Access and Accounting
Configuring the Physical Subscriber Line for RADIUS Access and Accounting Configuring a physical subscriber line for RADIUS Access and Accounting enables an L2TP access concentrator (LAC) and an L2TP network
More informationDHCP Server RADIUS Proxy
The Dynamic Host Configuration Protocol (DHCP) Server RADIUS Proxy is a RADIUS-based address assignment mechanism in which a DHCP server authorizes remote clients and allocates addresses based on replies
More informationConfiguring FlexVPN Spoke to Spoke
Last Published Date: March 28, 2014 The FlexVPN Spoke to Spoke feature enables a FlexVPN client to establish a direct crypto tunnel with another FlexVPN client leveraging virtual tunnel interfaces (VTI),
More informationAdaptive QoS over DMVPN
Adaptive QoS over Dynamic Multipoint VPN (DMVPN) ensures effective bandwidth management using dynamic shapers based on available bandwidth. This feature enables various QoS features to adapt to non service-level
More informationConfiguring IP Multicast over Unidirectional Links
Configuring IP Multicast over Unidirectional Links IP multicast requires bidirectional communication, yet some networks include broadcast satellite links, which are unidirectional. Unidirectional link
More informationSharing IPsec with Tunnel Protection
The feature allows sharing an IPsec security association database (SADB) between two or more generic routing encapsulation (GRE) tunnel interfaces when tunnel protection is used. Shared tunnel interfaces
More informationDynamic Multipoint VPN Configuration Guide, Cisco IOS Release 15M&T
Dynamic Multipoint VPN Configuration Guide, Cisco IOS Release 15M&T Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800
More informationIPv6 over DMVPN. Finding Feature Information
This document describes how to implement the Dynamic Multipoint VPN for IPv6 feature, which allows users to better scale large and small IPsec Virtual Private Networks (VPNs) by combining generic routing
More informationAdd Path Support in EIGRP
The feature enables hubs in a single Dynamic Multipoint VPN (DMVPN) domain to advertise multiple best paths to connected spokes when the Enhanced Interior Gateway Routing Protocol (EIGRP) is the routing
More informationIPsec NAT Transparency
sec NAT Transparency First Published: November 25, 2002 Last Updated: March 1, 2011 The sec NAT Transparency feature introduces support for Security (sec) traffic to travel through Network Address Translation
More informationNAT Routemaps Outside-to-Inside Support
The feature enables you to configure a NAT routemap configuration that allows IP sessions to be initiated from outside the network to inside the network. This module explains how to configure the feature.
More informationVirtual Private Networks Advanced Technologies
Virtual Private Networks Advanced Technologies Petr Grygárek rek Agenda: Supporting Technologies (GRE, NHRP) Dynamic Multipoint VPNs (DMVPN) Group Encrypted Transport VPNs (GET VPN) Multicast VPNs (mvpn)
More informationVirtual Private Networks Advanced Technologies
Virtual Private Networks Advanced Technologies Petr Grygárek rek Agenda: Supporting Technologies (GRE, NHRP) Dynamic Multipoint VPNs (DMVPN) Group Encrypted Transport VPNs (GET VPN) Multicast VPNs (mvpn)
More informationRADIUS Tunnel Attribute Extensions
The feature allows a name to be specified (other than the default) for the tunnel initiator and the tunnel terminator in order to establish a higher level of security when setting up VPN tunneling. Finding
More informationPre-Fragmentation for IPSec VPNs
Pre-Fragmentation for IPSec VPNs Feature History Release 12.1(11b)E 12.2(13)T 12.2(14)S Modification This feature was introduced. This feature was integrated into Cisco IOS Release 12.2(13)T. This feature
More informationFlow-Based per Port-Channel Load Balancing
The feature allows different flows of traffic over a Gigabit EtherChannel (GEC) interface to be identified based on the packet header and then mapped to the different member links of the port channel.
More informationConfiguring Local Authentication and Authorization
Configuring Local Authentication and Authorization Finding Feature Information, page 1 How to Configure Local Authentication and Authorization, page 1 Monitoring Local Authentication and Authorization,
More informationConfiguring Hosted NAT Traversal for Session Border Controller
Configuring Hosted NAT Traversal for Session Border Controller The Cisco IOS Hosted NAT Traversal for Session Border Controller Phase-1 feature enables a Cisco IOS Network Address Translation (NAT) Session
More informationConfiguring Embedded Resource Manager-MIB
The Embedded Resource Manager (ERM)-MIB feature introduces MIB support for the ERM feature. The ERM feature tracks resource usage information for every registered resource owner and resource user. The
More informationPassword Strength and Management for Common Criteria
Password Strength and Management for Common Criteria The Password Strength and Management for Common Criteria feature is used to specify password policies and security mechanisms for storing, retrieving,
More informationThe MSCHAP Version 2 feature (introduced in Cisco IOS Release 12.2(2)XB5) allows Cisco routers to
The feature (introduced in Cisco IOS Release 12.2(2)XB5) allows Cisco routers to utilize Microsoft Challenge Handshake Authentication Protocol Version 2 (MSCHAP V2) authentication for PPP connections between
More informationConfiguring MPLS Egress NetFlow Accounting and Analysis
Configuring MPLS Egress NetFlow Accounting and Analysis This module contains information about and instructions for configuring the MPLS Egress NetFlow Accounting feature. The MPLS Egress NetFlow Accounting
More informationEnabling ALGs and AICs in Zone-Based Policy Firewalls
Enabling ALGs and AICs in Zone-Based Policy Firewalls Zone-based policy firewalls support Layer 7 application protocol inspection along with application-level gateways (ALGs) and application inspection
More informationFlexible Dynamic Mesh VPN draft-detienne-dmvpn-00
Flexible Dynamic Mesh VPN draft-detienne-dmvpn-00 Fred Detienne, Cisco Systems Manish Kumar, Cisco Systems Mike Sullenberger, Cisco Systems What is Dynamic Mesh VPN? DMVPN is a solution for building VPNs
More informationAAA Dead-Server Detection
The feature allows you to configure the criteria to be used to mark a RADIUS server as dead. If no criteria are explicitly configured, the criteria are computed dynamically on the basis of the number of
More informationMPLS VPN over mgre. Finding Feature Information. Last Updated: November 1, 2012
MPLS VPN over mgre Last Updated: November 1, 2012 The MPLS VPN over mgre feature overcomes the requirement that a carrier support multiprotocol label switching (MPLS) by allowing you to provide MPLS connectivity
More informationConfiguring the Physical Subscriber Line for RADIUS Access and Accounting
Configuring the Physical Subscriber Line for RADIUS Access and Accounting Last Updated: December 5, 2011 Configuring a physical subscriber line for RADIUS Access and Accounting enables an L2TP access concentrator
More informationConfiguring IP Multicast over Unidirectional Links
Configuring IP Multicast over Unidirectional Links Last Updated: December 16, 2011 IP multicast requires bidirectional communication, yet some networks include broadcast satellite links, which are unidirectional.
More informationDynamic Multipoint VPN Configuration Guide
First Published: 2011-10-14 Last Modified: 2014-01-10 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387)
More informationEnabling ALGs and AICs in Zone-Based Policy Firewalls
Enabling ALGs and AICs in Zone-Based Policy Firewalls Zone-based policy firewalls support Layer 7 application protocol inspection along with application-level gateways (ALGs) and application inspection
More informationIGMP Static Group Range Support
IGMP Static Group Range Support Last Updated: December 16, 2011 The IGMP Static Group Range Support feature introduces the capability to configure group ranges in class maps and attach class maps to the
More informationMatch-in-VRF Support for NAT
The feature supports Network Address Translation (NAT) of packets that communicate between two hosts within the same VPN routing and forwarding (VRF) instance. In intra-vpn NAT, both the local and global
More informationConfiguring Cache Services Using the Web Cache Communication Protocol
Configuring Cache Services Using the Web Cache Communication Protocol Finding Feature Information, page 1 Prerequisites for WCCP, page 1 Restrictions for WCCP, page 2 Information About WCCP, page 3 How
More informationDHCP Server Port-Based Address Allocation
The feature provides port-based address allocation support on the Cisco IOS Dynamic Host Configuration Protocol (DHCP) server for the Ethernet platform. The DHCP server provides address assignment support
More informationEncrypted Vendor-Specific Attributes
Encrypted Vendor-Specific Attributes Last Updated: January 15, 2012 The Encrypted Vendor-Specific Attributes feature provides users with a way to centrally manage filters at a RADIUS server and supports
More informationMulticastForwardingInformationBaseOverview
MulticastForwardingInformationBaseOverview The Multicast Forwarding Information Base (MFIB) architecture provides modularity and separation between the multicast control plane (Protocol Independent Multicast
More informationNBAR2 HTTP-Based Visibility Dashboard
The NBAR2 HTTP-based Visibility Dashboard provides a web interface displaying network traffic data and related information. The information is presented in an intuitive, interactive graphical format. Finding
More informationAToM Graceful Restart
AToM Graceful Restart Last Updated: November 29, 2011 The AToM Graceful Restart feature assists neighboring routers that have nonstop forwarding (NSF), stateful switchover (SSO) and graceful restart (GR)
More informationIEEE 802.1X Multiple Authentication
The feature provides a means of authenticating multiple hosts on a single port. With both 802.1X and non-802.1x devices, multiple hosts can be authenticated using different methods. Each host is individually
More informationPer-Flow Admission. Finding Feature Information. Prerequisites for Per-Flow Admission
The feature provides explicit controls to limit packet flow into a WAN edge in order to protect already admitted flows on the routing/wan edge. Finding Feature Information, page 1 Prerequisites for, page
More informationImplementing Dynamic Multipoint VPN for IPv6
Implementing Dynamic Multipoint VPN for IPv6 First Published: July 11, 2008 Last Updated: November 24, 2010 This document describes how to implement Dynamic Multipoint VPN for IPv6 feature, which allows
More informationRestrictions for Disabling Flow Cache Entries in NAT and NAT64
The feature allows you to disable flow cache entries for dynamic and static Network Address Translation (NAT) translations. Disabling flow cache entries for dynamic and static translations saves memory
More informationConfiguring System MTU
Restrictions for System MTU, on page 1 Information About the MTU, on page 1 How to Configure MTU, on page 2 Configuration Examples for System MTU, on page 4 Additional References for System MTU, on page
More informationStateful Network Address Translation 64
The feature provides a translation mechanism that translates IPv6 packets into IPv4 packets and vice versa. The stateful NAT64 translator algorithmically translates the IPv4 addresses of IPv4 hosts to
More informationMPLS over GRE. Finding Feature Information. Prerequisites for MPLS VPN L3VPN over GRE
The feature provides a mechanism for tunneling Multiprotocol Label Switching (MPLS) packets over a non-mpls network. This feature utilizes MPLS over generic routing encapsulation (MPLSoGRE) to encapsulate
More informationMultiprotocol Label Switching (MPLS) on Cisco Routers
Multiprotocol Label Switching (MPLS) on Cisco Routers This document describes commands for configuring and monitoring Multiprotocol Label Switching (MPLS) functionality on Cisco routers and switches. This
More informationshow ipv6 nat translations, on page 71
show ip masks, on page 4 show ip nat limits all-host, on page 5 show ip nat limits all-vrf, on page 7 show ip nat nvi statistics, on page 9 show ip nat nvi translations, on page 11 show ip nat redundancy,
More informationIP Addressing: NHRP Configuration Guide
Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION
More informationBGP Link Bandwidth. Finding Feature Information. Prerequisites for BGP Link Bandwidth
The Border Gateway Protocol (BGP) Link Bandwidth feature is used to advertise the bandwidth of an autonomous system exit link as an extended community. This feature is configured for links between directly
More informationL2TP IPsec Support for NAT and PAT Windows Clients
L2TP IPsec Support for NAT and PAT Windows Clients The L2TP IPsec Support for NAT and PAT Windows Clients feature allows mulitple Windows client to connect to an IPsec-enabled Cisco IOS Layer 2 Tunneling
More informationClock Recovery System
The recovers the service clock using Adaptive Clock Recovery (ACR) and Differential Clock Recovery (DCR). Finding Feature Information, page 1 Information About Clock Recovery, page 1 Prerequisites for
More informationBulk Logging and Port Block Allocation
The feature allocates a block of ports for translation instead of allocating individual ports. This feature is supported only in carrier-grade Network Address Translation (CGN) mode. This module provides
More informationCarrier Grade Network Address Translation
(CGN) is a large-scale NAT that translates private IPv4 addresses into public IPv4 addresses. CGN employs Network Address and Port Translation methods to aggregate multiple private IPv4 addresses into
More informationConfiguring the Cisco Discovery Protocol
Finding Feature Information, page 1 Information About CDP, page 1 How to Configure CDP, page 3 Monitoring and Maintaining CDP, page 11 Additional References, page 12 Feature History and Information for
More informationBGP Event-Based VPN Import
BGP Event-Based VPN Import Last Updated: April 13, 2012 The BGP Event-Based VPN Import feature introduces a modification to the existing Border Gateway Protocol (BGP) path import process. The enhanced
More informationNetflow v9 for IPv6. Finding Feature Information. Prerequisites for Netflow v9 for IPv6. Information About Netflow v9 for IPv6
Netflow v9 for IPv6 Last Updated: July 31, 2012 This module contains information about and instructions for configuring NetFlow and NetFlow Data Export (NDE) for capturing and exporting data from IP version
More informationBGP-RT and VPN Distinguisher Attribute Rewrite Wildcard
BGP-RT and VPN Distinguisher Attribute Rewrite Wildcard The BGP RT and VPN Distinguisher Attribute Rewrite Wildcard feature introduces the ability to set a range of route target (RT) community attributes
More informationPer-Flow Admission. Finding Feature Information. Prerequisites for Per-Flow Admission
The feature provides explicit controls to limit packet flow into a WAN edge in order to protect already admitted flows on the routing/wan edge. Finding Feature Information, page 1 Prerequisites for, page
More information8K GM Scale Improvement
The feature supports optimization of the Cooperative Protocol (COOP) announcement messages by increasing the number of Group Members (GM) to 8000. Finding Feature Information, page 1 Prerequisites for,
More informationSIP ALG Resilience to DoS Attacks
The feature provides protection against Session Initiation Protocol (SIP) application layer gateway (ALG) denial of service (DoS) attacks. This feature supports a configurable lock limit, a dynamic blacklist,
More informationConfiguring the Cisco IOS DHCP Relay Agent
All Cisco devices that run Cisco software include a DHCP server and the relay agent software. A DHCP relay agent is any host or IP device that forwards DHCP packets between clients and servers. This module
More informationDMVPN for R&S CCIE Candidates Johnny Bass CCIE #6458
DMVPN for R&S CCIE Candidates Johnny Bass CCIE #6458 BRKCCIE-3003 @CCIE6458 2015 Cisco and/or its affiliates. All rights reserved. Cisco Public About the Presenter Johnny Bass Networking industry since
More informationCisco Discovery Protocol Version 2
Cisco Discovery Protocol (formerly known as CDP) is a Layer 2, media-independent, and network-independent protocol that runs on Cisco devices and enables networking applications to learn about directly
More informationConfiguring a Load-Balancing Scheme
This module contains information about Cisco Express Forwarding and describes the tasks for configuring a load-balancing scheme for Cisco Express Forwarding traffic. Load-balancing allows you to optimize
More informationConfiguring Switched Port Analyzer
This document describes how to configure local Switched Port Analyzer (SPAN) and remote SPAN (RSPAN) on the router. Finding Feature Information, page 1 Prerequisites for Configuring Local Span and RSPAN,
More informationDYNAMIC MULTIPOINT VPN SPOKE TO SPOKE DIRECT TUNNELING
DYNAMIC MULTIPOINT VPN SPOKE TO SPOKE DIRECT TUNNELING NOVEMBER 2004 1 Direct Spoke To Spoke Tunnels Initially, spoke to spoke traffic can only travel via the hub In DMVPN, spokes can send packets directly
More informationConfiguring Ethernet Management Ports
Finding Feature Information, on page 1 Prerequisites for Ethernet Management Ports, on page 1 Information about the Ethernet Management Port, on page 1 How to Configure the Ethernet Management Port, on
More informationConfiguring OSPF TTL Security Check and OSPF Graceful Shutdown
Configuring OSPF TTL Security Check and OSPF Graceful Shutdown This module describes configuration tasks to configure various options involving Open Shortest Path First (OSPF). This module contains tasks
More informationConfiguring Ethernet Management Port
Finding Feature Information, page 1 Prerequisites for Ethernet Management Ports, page 1 Information about the Ethernet Management Port, page 1 How to Configure the Ethernet Management Port, page 4 Additional
More informationRADIUS Attribute 66 Tunnel-Client-Endpoint Enhancements
RADIUS Attribute 66 Tunnel-Client-Endpoint The RADIUS Attribute 66 (Tunnel-Client-Endpoint) feature allows the hostname of the network access server (NAS) to be specified--rather than the IP address of
More informationOTV Loopback Join Interface
This chapter contains the following sections: Finding Feature Information, page 1 Information About, page 1 Licensing Information for, page 2 Guidelines and Limitationsfor, page 2 Prerequisites for, page
More informationConfiguring Ethernet Management Ports
Finding Feature Information, page 1 Prerequisites for Ethernet Management Ports, page 1 Information about the Ethernet Management Port, page 1 How to Configure the Ethernet Management Port, page 4 TFTP
More informationIPv6 Routing: RIP for IPv6
IPv6 Routing Information Protocol (RIP) functions the same and offers the same benefits as IPv4 RIP. RIP enhancements for IPv6, detailed in RFC 2080, include support for IPv6 addresses and prefixes and
More informationDMVPN for R&S CCIE Candidates
DMVPN for R&S CCIE Candidates Johnny Bass CCIE #6458 BRKCCIE-3003 @CCIE6458 2014 Cisco and/or its affiliates. All rights reserved. Cisco Public About the Presenter Johnny Bass Networking industry since
More informationQoS Tunnel Marking for GRE Tunnels
The feature introduces the capability to define and control the quality of service (QoS) for both incoming and outgoing customer traffic on the provider edge (PE) router in a service provider network.
More informationExclusive Configuration Change Access and Access Session Locking
Exclusive Configuration Change Access and Access Session Locking Exclusive Configuration Change Access (also called the Configuration Lock feature) allows you to have exclusive change access to the Cisco
More informationCisco IOS Login Enhancements-Login Block
The Cisco IOS Login Enhancements (Login Block) feature allows users to enhance the security of a router by configuring options to automatically block further login attempts when a possible denial-of-service
More informationSSH Algorithms for Common Criteria Certification
The feature provides the list and order of the algorithms that are allowed for Common Criteria Certification. This module describes how to configure the encryption, Message Authentication Code (MAC), and
More informationConfiguring VLAN Trunks
Finding Feature Information, page 1 Prerequisites for VLAN Trunks, page 1 Information About VLAN Trunks, page 2 How to Configure VLAN Trunks, page 5 Configuration Examples for VLAN Trunking, page 20 Where
More informationMPLS VPN--Show Running VRF
MPLS VPN--Show Running VRF Last Updated: December 15, 2011 The MPLS VPN--Show Running VRF feature provides a Cisco IOS command-line interface (CLI) option to display a subset of the running configuration
More informationOSPFv2 Local RIB. Finding Feature Information
With the feature, each OSPF protocol instance has its own local Routing Information Base (RIB). The OSPF local RIB serves as the primary state for OSPF SPF route computation. The global RIB is not updated
More informationConfigurable Number of Simultaneous Packets per Flow
Configurable Number of Simultaneous Packets per Flow In zone-based policy firewalls, the number of simultaneous packets per flow is restricted to 25 and packets that exceed the limit are dropped. The dropping
More informationDynamic Bandwidth Sharing
The Cisco cbr series router enables dynamic bandwidth sharing (DBS) on integrated cable (IC) and wideband (WB) cable interfaces. Finding Feature Information Your software release may not support all the
More informationClock Recovery System
The recovers the service clock using Adaptive Clock Recovery (ACR) and Differential Clock Recovery (DCR). Finding Feature Information, on page 1 Information About Clock Recovery, on page 1 Prerequisites
More informationCisco Discovery Protocol Version 2
Cisco Discovery Protocol (formerly known as CDP) is a Layer 2, media-independent, and network-independent protocol that runs on Cisco devices and enables networking applications to learn about directly
More informationRate Based Satellite Control Protocol
(RBSCP) was designed for wireless or long-distance delay links with high error rates, such as satellite links. Using tunnels, RBSCP can improve the performance of certain IP protocols, such as TCP and
More informationContextual Configuration Diff Utility
The feature provides the ability to perform a line-by-line comparison of any two configuration files (accessible through the Cisco IOS XE Integrated File System [IFS]) and generate a list of the differences
More informationMPLS LDP Autoconfiguration
First Published: November 8, 2004 Last Updated: November 25, 2009 The feature enables you to globally configure Label Distribution Protocol (LDP) on every interface associated with a specified Interior
More informationConfiguring the Service Discovery Gateway
Finding Feature Information, page 1 Restrictions for, page 1 Information about the Service Discovery Gateway and mdns, page 2 How to Configure the Service Discovery Gateway, page 5 Monitoring Service Discovery
More informationHTTPS--HTTP Server and Client with SSL 3.0
The feature provides Secure Socket Layer (SSL) version 3.0 support for the HTTP 1.1 server and HTTP 1.1 client within Cisco IOS XE software. SSL provides server authentication, encryption, and message
More information